40
Any failure to protect
the confidentiality of customer information could adversely affect our reputation
and have a material
adverse effect on our business, financial condition and results
of operations
.
Various
laws enforced by the bank regulators and other agencies protect the privacy and security of
customers’ non-public
personal information. Many of our employees have access to, and routinely process
personal information of clients through
a variety of media, including information technology systems.
Our internal processes, policies and controls are designed to
protect the confidentiality of client information we hold and that is accessible to us and our
employees. It is possible that an
employee could, intentionally or unintentionally,
disclose or misappropriate confidential client information or our data
could be the subject of a cybersecurity attack.
Such personal data could also be compromised via intrusions into our
systems or those of our service providers or other persons we do business with such as credit
bureaus, data processors and
merchants who accept credit or debit cards for payment. If we fail to maintain adequate
internal controls, or if our
employees fail to comply with our policies and procedures, misappropriation
or inappropriate disclosure or misuse of client
information could occur. Such
internal control inadequacies or non-compliance could materially damage our reputation,
lead to remediation costs and civil or criminal penalties.
These could have a material adverse effect on our business,
financial condition and results of operations.
See Item 1C. of this report for more information about cybersecurity and our
management and strategies.
Our information systems may experience interruptions and security brea
ches.
We rely heavily on communications
and information systems, including those provided by third-party service
providers, to
conduct our business.
Any failure, interruption, or security breach of these systems could result in failures or
disruptions
which could affect our customers’ privacy and our customer relationships,
generally.
Our business continuity plans,
including those of our service providers, for back-up and service restoration, may
not be effective in the case of widespread
outages due to severe weather, natural disasters, pandemics,
or power, communications and other failures.
See Item 1C. of
this report for more information about cybersecurity and our management and strategies.
Our systems and networks, as well as those of our third-party service providers,
are subject to security risks and could be
susceptible to disruption through cyber-attacks, such as denial of service attacks, hacking,
terrorist activities, or identity
theft.
Cybercrime risks have increased as electronic and mobile banking activities increased
as a result of the COVID-19
pandemic, and may increase as a result of the Russia invasion of Ukraine and tensions
with mainland China and other
countries.
Other financial service institutions and their service providers have reported
material security breaches in their
websites or other systems, some of which have involved sophisticated and targeted
attacks, including use of stolen access
credentials, malware, ransomware, phishing and distributed denial-of
-service attacks, among other means.
Such cyber-
attacks may also seek to disrupt the operations of public companies or their business partners,
effect unauthorized fund
transfers, obtain unauthorized access to confidential information, destroy data,
disable or degrade service, or sabotage
systems.
Hacking and identity theft risks, in particular, could
cause serious reputational harm.
Despite our cybersecurity policies and procedures and our Board
of Directors and management’s efforts to
monitor and
ensure the integrity of the systems we and our third-party service providers
use, we may not be able to anticipate the rapidly
evolving security threats, nor may we be able to implement preventive measures effective
against all such threats.
The
techniques used by cyber criminals change frequently,
may not be recognized until launched and can originate from a wide
variety of sources, including external service providers, organized
crime affiliates, terrorist organizations or hostile
foreign
governments.
These risks may increase in the future as the use of mobile banking and other
internet electronic banking
continues to grow.
Security breaches or failures may have serious adverse financial and other consequences,
including significant legal and
remediation costs, disruptions to operations, misappropriation of confidential information,
damage to systems operated by
us or our third-party service providers, as well as damages to our customers and our counterparties.
In addition, these events
could damage our reputation, result in a loss of customer business, subject us to additional
regulatory scrutiny, or expose
us
to civil litigation and possible financial liability,
any of which could have a material adverse effect on our
financial
condition and results of operations.
In July 2023, the SEC adopted rules, effective September 5, 2023,
that
require reporting companies to disclose material
cybersecurity incidents they experience on SEC Form 8-K within four business days,
nature, scope, and timing of the
incident, and the material impact or reasonably likely material impact on the registrant,
including its financial condition and
results of operations.
As a smaller reporting company, the Company
has to comply with these Form 8-K reporting
requirements beginning June 15, 2024.
Annually, reporting companies are required
to disclose
material information
regarding their cybersecurity risk management, strategy,
and governance, beginning for years ending on or after December